antidot

Sharing

General

Target

ChromeSetup_v.13.06.11.apk
Size

9.4MB
Sample

250124-yzmtnsxpgm
MD5

a46b20b8a7bddbd0adfd01654f456c09
SHA1

c9681ad05915a1db4d7182c2b6cd0c8eadb4b480
SHA256

edcf2f02a491fab69c3c18610c9d72966567c632ff4d881e4dc6d7154019d8e3
SHA512

4cb2a5bd66f2566f1f4a81eaacc40d744ded9542d519187df96ac7059e6ecb33976ab7aa8d6a3bc1327517e1f911d3af8e6cff292a93d517ba79fafeb0080a76
SSDEEP

196608:wEYBfTwwaC4vfd3UPfhCYzlQMufB2rJxs49XdhCrj4QzO016:dfC4v1WvdFxs49azO+6

Score

10^/10

Malware Config

Targets

- Target
  
  ChromeSetup_v.13.06.11.apk
- Size
  
  9.4MB
- MD5
  
  a46b20b8a7bddbd0adfd01654f456c09
- SHA1
  
  c9681ad05915a1db4d7182c2b6cd0c8eadb4b480
- SHA256
  
  edcf2f02a491fab69c3c18610c9d72966567c632ff4d881e4dc6d7154019d8e3
- SHA512
  
  4cb2a5bd66f2566f1f4a81eaacc40d744ded9542d519187df96ac7059e6ecb33976ab7aa8d6a3bc1327517e1f911d3af8e6cff292a93d517ba79fafeb0080a76
- SSDEEP
  
  196608:wEYBfTwwaC4vfd3UPfhCYzlQMufB2rJxs49XdhCrj4QzO016:dfC4v1WvdFxs49azO+6
Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan
- Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Antidot family
  antidot
- Antidot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Checks the application is allowed to request package installs through the package installer
  Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).
  defense_evasion
- Queries the mobile country code (MCC)
  discovery
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  
  lohehocowa
- Size
  
  9.0MB
- MD5
  
  a77510d5c5df5c2d445237895be28c26
- SHA1
  
  4733c9a24570b37fb03f97355c2016ef10d3d045
- SHA256
  
  a2c3c118dde0e9cbf7cc815ebe21258ec99a860eada0cd9fde6870b70d72f54e
- SHA512
  
  b3b5dc6687bea980f7a5bdff70494f0415de21d6bba09f0b98e8da0b6fa29f59d6607282d7d506bc3ce9436ef1c96b1570e393c1b0ef346cf7d02695f3a66472
- SSDEEP
  
  98304:3o/Kr9mcYvsb33zJoBUuJqn8e5KKg5nO6qelM1Bp9KeHFNuUZlMbtEgwwZZoDLcf:2cPb3DJoBULLlcUZBYErSsc
Score

10^/10

antidot banker collection credential_access defense_evasion discovery evasion execution impact infostealer persistence trojan
- Antidot
  Antidot is an Android banking trojan first seen in May 2024.
  banker trojan infostealer antidot
- Antidot family
  antidot
- Antidot payload
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Makes use of the framework's Accessibility service
  Retrieves information displayed on the phone screen using AccessibilityService.
  collection defense_evasion credential_access
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)
  banker discovery
- Reads the contacts stored on the device.
  collection
- Reads the content of the SMS messages.
  collection
- Performs UI accessibility actions on behalf of the user
  Application may abuse the accessibility service to prevent their removal.
  evasion
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Requests uninstalling the application.
  defense_evasion
behavioral5 behavioral6 behavioral7 behavioral8